Evidence of meeting #55 for Access to Information, Privacy and Ethics in the 41st Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was nexopia.
A video is available from Parliament.
3:30 p.m.
NDP
The Chair NDP Pierre-Luc Dusseault
Order. We will begin. As you know, in accordance with today's agenda, we are continuing the study on privacy and social media.
With us today is Mr. Bartus, who is here on behalf of Nexopia. He is joined by Mark Hayes, from the Heydary Hayes law firm. He will be able to answer more specific questions, if the committee wishes.
Without further ado, I will let Mr. Bartus begin his 10-minute presentation. Following that, as usual, we will have some time to ask him questions.
Mr. Bartus, go ahead.
3:30 p.m.
Kevin Bartus Chief Executive Officer, Nexopia Inc.
Thank you, Mr. Chairman.
My name is Kevin Bartus. I’m the CEO and owner of Nexopia Incorporated, the operator of nexopia.com. With me is Mark Hayes, the managing director of Heydary Hayes PC. Mark is a well-known privacy lawyer in Canada who is advising Nexopia on privacy matters, and I would ask the committee’s indulgence in allowing Mark to join me in order to assist with any technical privacy questions.
Thank you for inviting us to join you today. I want to apologize in advance for any areas in which my knowledge is lacking. As you know, we were made aware of this meeting less than a week ago and we’ve only owned Nexopia for a month. That said, my own background in digital media is fairly extensive. I own and run Ideon Media, a Canadian digital advertisement network. I also own and run Maple Media, a Canadian digital publisher. I was the original vice-president of Digital Media for Rogers Media in Toronto, and I built one of the early dot-com web developers called Blue Spark.
Nexopia was founded, as many of you know, in 2004 by an Edmonton-based teenager as an open community for Canadian youth, a sort of MySpace for Canadians. The site grew rapidly and attracted professional investment a few years later. With the meteoric rise of Facebook, however, sites like Nexopia and MySpace retreated to a core user base. Nexopia had over two million members a few years ago, but focuses on a core of about 200,000 today.
Comscore Canada currently lists 70 social networking sites larger than Nexopia in Canada, including major U.S. sites such as Facebook, which has about 22.4 million monthly unique visitors, according to Comscore Canada in September 2012. LinkedIn has about 5.3 million; Pinterest has about 2.8 million; MySpace, 1.4 million. And there are sites that are closer to Nexopia's size, such as Tagged, with 219,000; Multiply, with 181,000; and Hi5 with 152,000.
Over the past few years, major newspaper, magazine, and broadcast media websites have introduced extensive social networking capabilities, allowing users to post personal profiles in addition to participating in online forums. Meanwhile, social networks like MySpace have begun to integrate original content relevant to their core audience. In MySpace's case, it's content like music and entertainment. The line between social networks and media sites has become blurry indeed.
Smaller sites like Nexopia generally focus on a niche, and Nexopia focuses on young Canadian adults, aged 16 to 24. The focus has worked. Nexopia members are more engaged than members on most other social networks, with about six minutes and 14 pages per visit, compared to an average of about five minutes and 10 pages for the Comscore category overall of social networking sites.
Nexopia fills a vital niche for young Canadians. In addition to being the only major Canadian-based social network, Nexopia allows young Canadians to meet others who may not already be in their offline social network, as opposed to Facebook and LinkedIn, which focus on real-world identities. This social discovery function of meeting people who users don’t already know is particularly important in Canada, where members may live in smaller physical communities and have trouble finding like-minded others. It's also critical for young Canadians who may not yet have been able to find like-minded others who share their experience.
Nexopia’s ambition is to be a clean, well-lit community place for social discourse, and as such, Nexopia is a rigorously moderated community. There are about 20 moderators who review every picture before it's posted, every forum post, and every abuse complaint.
Nexopia does not use profile or other personal information to target advertising. This is both a commitment to the community and also a practical reality, because such advertisement targeting really only works at a large scale. Advertisers who are interested in Nexopia’s demographic become less interested when the membership is subdivided into smaller and smaller segments, simply because there are then too few members to constitute a meaningful advertising campaign.
Partly because of Nexopia’s success among young Canadians and its open nature, Nexopia attracted the interest of the Privacy Commissioner in 2010, and in March 2012 the Privacy Commissioner issued a detailed finding.
This report includes 24 recommendations. In case you haven't read it, it's broadly in three areas: first, the completeness of the site’s privacy policy and the ease with which informed consent could be given; second, the openness with which profiles were being shared, particularly among non-members and with members who were not friends; and third, assuring members that when they leave the community, their data is permanently deleted.
For a number of reasons, the prior owners chose to sell the company following the release of the commissioner’s recommendations. I purchased Nexopia Incorporated from the prior owners on September 30, 2012—about a month ago. Since that time, we've been actively engaged with the Privacy Commissioner to ensure that all privacy issues are addressed.
Some of the required changes to the site will require significant time and development. We've worked out a schedule with the commissioner’s office for dealing with all of the commissioner’s concerns and expect to be fully compliant with the commissioner’s recommendations by April 30, 2013.
I'm happy to report that we've already completed the implementation of some of the recommendations.
We believe that young Canadian adults deserve an online home. In our view, this should be a clean, well-lit community with ample moderation that also integrates relevant content in areas such as music and entertainment. Nexopia members have been incredibly loyal over the past few years, and we intend to reward that loyalty with new investments in functionality and content.
Most Canadians experience the Internet primarily as a U.S. phenomenon, with a few local sites from Canadian newspapers and broadcasters. We are deeply committed to the belief that the Canadian experience is enriched with Canadian-owned and Canadian-operated websites. However, the scale economies of running an online business mean that the same costs in content and technology are simply spread over a user base and advertising market one-tenth the size of the U.S. This creates financial and technological hurdles that can be a challenge.
In the past year we have witnessed many of the large Canadian media companies backing away from advertising-driven, online-only initiatives. During 2012, Rogers Media closed down virtually every online-only acquisition it had made over the last few years, including branchez-vous.com, sweetspot.ca, and canadianparents.com. Also during 2012, Transcontinental shuttered WOMAN.ca, and Torstar closed parentcentral.ca. Last month, both Torstar and the Globe and Mail announced paywalls, which may or may not have been wise long-term financial decisions, but the resulting smaller audience will most certainly erode their ability to attract digital advertising. There are precious few successful online-only initiatives that focus on Canadian consumers and Canadian advertisers, and we are proud that Nexopia is one of them.
Canadian privacy regulations serve an important role in protecting Canadians and in levelling the playing field among digital corporations. But launching a major advertising-sponsored online initiative already takes significant capital resources and several years. I ask that you tread carefully when making this any more challenging than it needs to be.
Mr. Hayes and I would be pleased to try to answer any questions the members of the committee may have for us.
3:35 p.m.
NDP
The Chair NDP Pierre-Luc Dusseault
Thank you very much for your presentation.
Let's now move on to a question and answer period.
Mr. Angus, you have seven minutes.
3:35 p.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
Thank you, Mr. Chair.
Thank you, Mr. Bartus and Mr. Hayes, for coming. We really are appreciative that you have come on relatively short notice. As you know, as a committee, we are looking at what steps we need to take as legislators, if any, in terms of ensuring that we're developing the incredible online potential for innovation and for communication, while also ensuring protection of Canadians' data.
We've learned again and again that our Privacy Commissioner has a very high level of respected expertise worldwide in being able to adjudicate these issues, probably much greater expertise than we parliamentarians do. We would prefer, at least in the New Democratic Party, to rely on the Privacy Commissioner's judgment as much as possible.
I understand that there were 24 recommendations following the investigation into Nexopia. You are now the new owner, so you are dealing with what was done before you came on.
We were under the impression, from reading the Privacy Commissioner's report, that there were four recommendations that the previous owners of Nexopia had refused to implement. Will you be in compliance with the 24 recommendations? Is that the plan?
3:35 p.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
Are you saying that what you need is time to meet that because of the technical issues?
3:35 p.m.
Chief Executive Officer, Nexopia Inc.
Yes. In fact, we were in discussion with the Privacy Commissioner prior to the closing of the acquisition. One of the things I wanted to look into was whether the timeframe would be able to be reset from what was given to the previous owners. Mark and I spoke with them at some length, and we were able to establish a timeframe that we think works.
3:35 p.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
That's excellent.
Again, wherever we have met with experts, players in the field...we keep hearing very good things about the Privacy Commissioner.
Have you found the Privacy Commission to be reasonable in terms of...? Well, they're expecting compliance, but in understanding that as new owners you are trying to be compliant, are they willing to work with you on this?
3:35 p.m.
Chief Executive Officer, Nexopia Inc.
Yes, I would agree.
In fairness, I don't have experience with many other privacy commissioners, but this one has been reasonable with us, for sure.
3:35 p.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
Excellent.
One of the recommendations that the previous owners had not moved on was recommendation 19, which was to develop and make available on its website appropriate information to explain the policies and procedures to non-users and users alike. They had not been in compliance with that.
I noticed today that the privacy policy at Nexopia has not been updated since November 2, 2009. That seems to be a long time behind us. Do you expect that you'll be able to update that policy statement soon enough?
3:40 p.m.
Chief Executive Officer, Nexopia Inc.
Yes. We've broken the timeframe into a few main chunks. Updating the privacy policy is obviously easier than some of the other stuff. We expect to do that pretty quickly.
The closing has had a number of elements, and there have been some delays in it, including access to both the technology and the financial records, and that kind of stuff. We haven't done that as quickly as we'd like, but it should all be within the timeframe.
Mark, do you want to add anything?
3:40 p.m.
Mark Hayes Managing Director, Heydary Hayes PC, Nexopia Inc.
I think the privacy policy should be updated. I think the timing we're looking at is somewhere about the end of November or early December. We should be able to deal with it relatively quickly.
3:40 p.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
Excellent.
It seems that most of the concerns that were causing a dispute were on the deletion of information and the deletion of accounts. The Privacy Commissioner said:
...there are security risks inherent in retaining vast amounts of former users’ personal information, long after it has served its original purpose.
...our Office is concerned that Nexopia's users are being misled into thinking they can delete their personal information at some point, if they want to.
In this respect, Nexopia is retaining personal information without users' knowledge and consent. To us, that's a very serious issue, and we've heard that again and again, not in terms of your business model, but on the overall participation of especially young people, who, if they want to pull out, should be able to pull out.
Is it a technical issue that is going to be a barrier to meeting this recommendation? Do you see this as taking a bit longer? What is it? Is it technical or was it just part of a business model?
3:40 p.m.
Chief Executive Officer, Nexopia Inc.
Both. I think it's probably the latest chunk and the reason the timeframe is April and not December.
There are a couple of issues. One of them is the technical definition of what needs to be deleted—for example, a posting in a forum that another person started, so one person starts a thread and somebody else contributes to that thread and then that person leaves. It's both technically challenging and really without precedent anywhere else on the web for that whole thread to disappear. So that person's comments....
For example, if you go to a newspaper site today and you comment on a story and then you decide that you no longer want to be a member on that newspaper site, or whatever it might be, they don't delete your comments in those threads in any one that I've come across.
So I think to some degree there wasn't an engagement with the definition of what the owners were supposed to delete.
The second challenge is this. Nexopia has had a long track record of cooperating with law enforcement authorities on different investigations and didn't want to compromise that. Again, it's hard for me to speak on behalf of the previous owners, but there were a number of reasons—some voiced in those recommendations and findings and some voiced privately—that caused them not to move.
The technical part of deleting older data is less challenging than defining what exactly they were supposed to delete.
3:40 p.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
Okay. Yes, I noticed that the Privacy Commissioner had recognized your willingness to work with law enforcement. She did say, though, that it:
...may justify a longer retention period in specific cases, but they do not justify wholesale and indefinite retention of all records....
That was something they had clarified.
Your company sounds really interesting, and I'm really glad you're here to be able to get your side on the record. Dr. Valerie Steeves, who is very respected, made comments about you, and also John Lawford was here, and I'm sure you're very well aware of him. Both of them talked about the problem of.... She said that Nexopia seemed more interested in the monetary benefit of keeping data than privacy considerations.
You have the online forum; you have the advertising component. How do you balance out those two sometimes competing interests when the issue of privacy is put in the prism?
3:40 p.m.
Chief Executive Officer, Nexopia Inc.
I'm unaware of any financial benefit of keeping the data longer than some period of time. I did listen to her testimony. I haven't spoken with her and I don't know what she was getting at.
Regarding keeping data of users who have gone, the only reason it's there is we're trying to figure out how to get rid of it technically, and from a business perspective, which parts of it to get rid of. Our feeling now is that certainly the profile data and any data—a blog, for example, that the user has posted—should vanish when the user leaves. Our thought is that perhaps you want to keep the data around for a little while in case the user wants to come back, so for a few months certainly you want to be able to say to the user, “Are you sure you don't want to come back? Here is what your friends have been doing”—that sort of thing. But certainly there is no business reason that I'm aware of for keeping the data longer than perhaps two years.
3:40 p.m.
NDP
The Chair NDP Pierre-Luc Dusseault
Thank you.
I yield the floor to Ms. Davidson, who has seven minutes.
3:40 p.m.
Conservative
Patricia Davidson Conservative Sarnia—Lambton, ON
Thank you, Mr. Chair.
Thank you, gentlemen, for being with us this afternoon.
It's certainly an interesting topic, and it was interesting to hear what you had to say regarding your company. You've only owned it for about a month.
3:45 p.m.
Conservative
Patricia Davidson Conservative Sarnia—Lambton, ON
I want to go back to the Privacy Commissioner. It sounds as though you have established a fairly reasonable working relationship with the Privacy Commissioner, so I'm glad to hear that. As my colleague across has said, we've heard that from many different people who have dealt with the commissioner, so I'm glad to hear that you've had the same experience.
There were 24 recommendations that were made to the prior owners of your company, and there were 20 that were agreed to be implemented. As my colleague said, there were four that weren't. Did the former company implement any of those recommendations, or are they all outstanding? There were dates, I see, June, September.
3:45 p.m.
Chief Executive Officer, Nexopia Inc.
Yes. It's probably unfair for me to comment on much of what they did. At present there are, I believe, four of the recommendations implemented, primarily around a program that used to be called Earn Plus, where the sensitivity was that the data may have been shared outside of the organization. So that's fixed.
As the previous gentleman stated, the privacy policy is the next up to be fixed. That's relatively straightforward. The difficult ones are the true deletion one, which you referred to, and also the adjustment of profile settings, keeping some stuff public and some private, some to other members. That involves functionality changes that need to be thought through.
3:45 p.m.
Conservative
Patricia Davidson Conservative Sarnia—Lambton, ON
But it's your intention, then, to carry forth with the outstanding recommendations—
3:45 p.m.
Conservative
Patricia Davidson Conservative Sarnia—Lambton, ON
—and you gave the date of April 2013. Was that for the remainder of the outstanding ones?